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Abstract There are two incompatible Coq libraries that have a theory of the real 
numbers; the Coq standard library gives an axiomatic treatment of classical real num- 
bers, while the CoRN library from Nijmegen defines constructively valid real numbers. 
Unfortunately, this means results about one structure cannot easily be used in the 
other structure. We present a way interfacing these two libraries by showing that their 
real number structures are isomorphic assuming the classical axioms already present 
in the standard library reals. This allows us to use O'Connor's decision procedure for 
solving ground inequalities present in CoRN to solve inequalities about the reals from 
the Coq standard library, and it allows theorems from the Coq standard library to 
apply to problem about the CoRN reals. 

Keywords inequalities • real numbers ■ Coq 



1 Introduction 

Coq is a software proof assistant based on dependent type theory developed at INRIA [1]. 
By default, it reasons with constructive logic via the Curry-Howard isomorphism. The 
Curry-Howard isomorphism associates propositions with types and proofs of proposi- 
tions with programs of the associated type. This makes Coq a functional programming 
language as well as a deduction system. The identification of a programming language 
with a deduction system allows Coq to reason about programs and allows Coq to use 
computation to prove theorems. 

Coq can support classical reasoning by the declaration of additional axioms; how- 
ever, these additional axioms will not have any corresponding computational compo- 
nent. Therefore, using axioms may limit the ability for Coq to use computation to 
prove theorems. 

At least two different developments of the real numbers have been created for 
Coq. Coq's standard library declares the existence of the real numbers in an axiomatic 
fashion. This library also requires the axioms for classical logic. It gives users the 
familiar, classical real numbers. 
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The other formahzation of the real numbers is done constructively in the CoRN 
library [4]. This library specifies what a constructive real number structure is, and 
proves that all such real number structures are isomorphic. These real numbers are 
constructive and there is one effective implementation where real numbers can be 
evaluated to arbitrary precision within Coq. 

In this paper we show how to connect these two developments by showing that 
Coq's real numbers form a real number structure in CoRN. We do this by 

— Deriving some logical consequences of the classical real numbers (Section[2]). Specif- 
ically, we formally prove the well-known result that IIq would be decidable. 

— Using these logical consequences to prove that the classical real numbers form a 
constructive real number structure (Section (J)). 

— Using the resulting isomorphism between classical and constructive real numbers 
to prove some classical real number inequalities by evaluating constructive real 
number expressions (Section |4]). 

1.1 The two universes of Coq 

Coq has a mechanism for program extraction [8]. Programs developed in Coq can be 
translated into Ocaml, Ifaskell, or Scheme. If these programs are proved correct in Coq, 
then the extracted programs have high assurance of correctness. 

To facilitate extraction, Coq has two separate universes: the Set universe, and the 
Prop universe (plus an infinite series of Type universes on top of these two) . The Prop 
universe is intended to contain only logical propositions and its values are discarded 
during extraction. The types in the Set universe are computationally relevant the 
values of these types make up the extracted code. In order to maintain the soundness of 
extraction, the type system prevents information from flowing from the Prop universe to 
the Set universe. Otherwise, vital information could be thrown away during extraction, 
and the extracted programs would not run. 

The Prop/Set distinction will play an important role in our work. The logical 
operators occur in both universes. The following table lists some logical operations and 
their corresponding syntax for both the Prop and Set universes. 



Math Notation 


Prop Universe 


Set Universe 


A/\B 


A /\ B 


A * B 


A\/ B 


A \/ B 


A + B 


A-* B 


A -> B 


A -> B 




-A 


not used 


Vx ; X.P{x) 


forall x:X, P x 


forall x:X, P x 


3x : X.P(x) 


exists x:X, P x 


{ X : X 1 P X } 



One might think that proving that classical real numbers satisfy the requirements 
of a constructive real number structure would be trivial. Should not the constructive 
requirements be no stronger than the classical requirement for a real number structure 
when we use classical reasoning? However, Coq's Prop/Set distinction prevents a naive 
attempt at creating such an isomorphism between the classical and constructive real 
numbers. The difficulty is that classical reasoning is only allowed in the Prop universe. 
A constructive real number structure requires a Set-style existence in the proof that 
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the a sequence converges to its limit (see Section [3. ip . but the theory provided by the 
Coq standard Ubrary only proves a classical Prop-style existence. 

Although we have recently discovered a direct way to show that the classical Coq 
reals form a constructive real number structure, we will present our original solution 
that transforms the classical existentials provided by the Coq standard library into a 
constructive existential. This solution uses Coq's real number axioms to create con- 
structive existentials from classical existentials for any IIq sentence (Section[2]), a result 
that has wide reaching applications. 

2 Logical Consequences of Coq real numbers 

Coq's standard library defines the classical real numbers axiomatically. This axiomatic 
definition has some general logical consequences. In this section we present some of the 
axioms used to define the real numbers and then show how they imply the decidability 
of Tig sentences. The axioms of the real numbers cannot be effectively realized, so a 
decision procedure for 77q sentences is not implied by this decidability result. 

2.1 The axiomatic definition of the real numbers 

The definition for the reals in the Coq standard library asserts a set R, the constants 
0, 1, and the basic arithmetic operations: 

Parameter R : Set . 

Parameter RO : R. 

Parameter Rl : R. 

Parameter Rplus : R -> R -> R. 

Parameter Rmult : R -> R -> R. 

A numeric literal, such as 20, is simply notation for an expression, such as: 

(Rl+Rl) * ( (Rl+Rl) * (R1+ (Rl+Rl) * (Rl+Rl) ) ) 

In addition to the arithmetic operations, an order relation is asserted. 

Parameter Rlt : R -> R -> Prop. 

Axioms for these operations and relations define their semantics. There are 17 
axioms. We show only some relevant ones; the entire list of axioms can be found in 
the Coq standard library. The properties described by the axioms include associativity 
and commutativity of addition and multiplication, distributivity, and neutrality of zero 
and one. 

Axiom Rplus_comm : forall rl r2:R, rl + r2 = r2 + rl. 

There are also several axioms that state that the order relation for the real numbers 
form a total order. The most important axiom for our purposes will be the law of 
trichotomy: 

Axiom total_order_T : forall rl r2:R, {rl < r2> + {rl = r2} + {rl > r2}. 
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Finally, there is an Archimedian axiom and an axiom stating the least upper bound 
property. 

Peirameter up : R -> Z. 

Axiom archimed : forall r:R, IZR (up r) > r /\ IZR (up r) - r <= 1. 

Axiom completeness : 

forall E:R -> Prop, 

boimd E -> (exists x : R, E x) -> sigT (fun m:R => is_lub E m) . 

2.2 Decidability of IIq sentences 

It is important to notice that the trichotomy axiom uses Set-style disjunctions. This 
means that users are allowed to write functions that make decisions by comparing 
real numbers. This axiom might look surprising at first since real numbers are infinite 
structures and therefore comparing them is impossible in finite time in general. The 
motivation for this definition comes from classical mathematics where mathematicians 
regularly create functions based on real number trichotomy. It allows one to define a 
step function, which is not be definable in constructive mathematics. 

This trichotomy axiom can be used to decide any 77g property. For any decidable 
predicate over natural numbers P, we first define a sequence of terms that take values 
when the property is true: 



We can then define the sum of this infinite sequence, which is guaranteed to con- 
verge: 



The trichotomy axiom allows us to compare S with 2. It follows that if S = 2 then 
the predicate P hold for every natural number, and if 5 < 2 then it is not the case 
(the case of 5 > 2 is easily ruled out). Furthermore, this distinction can be made in 
Set universe. 

We formalized the above reasoning in Coq and we obtained the following logical 
theorem. 

f orall_dec 

: forall P : nat -> Prop, 

(forall n : nat, {P n> + {" P n}) -> 

{(forall n : nat, P n)} + {" (forall n : nat, P n)> 

2.2.1 Constructive indefinite description 

We can extend the previous result by using a general logical lemma of Coq. The con- 
structive indefinite description lemma states that if we have a decidable predicate over 

the natural numbers, then we can convert a Prop based existential into a Set based 
one. Its formal statement can be found in the standard library: 




(1) 



OO 




(2) 



n=0 
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construct ive_indefinite_description_nat 
: for all P : nat -> Prop, 

(forall X : nat, {P x} + {" P x}) -> 
(exists n : nat, P n) -> {n : nat I P n}- 

This lemma can be seen as a form of Markov's principle in Coq. The lemma works by 
doing a bounded search for a new witness satisfying the predicate. The witness from the 
Prop based existential is only used to prove termination of the search. No information 
flows from the Prop universe to the Set universe because the witness found for the Set 
based existential is independent of the witness from the Prop based one. 

Classical logic allows us to convert a negated universal statement into an existential 
statement in Prop: 

not_all_ex_not 

: forall (U : Type) (P : U -> Prop) , 

(forall n : U, P n) -> exists n : U, " P n 

By combining these theorems with our previous result, we get a theorem whose 
conclusion is either a constructive existential or a universal statement: 

sig_f orall_dec 

: forall P : nat -> Prop, 

(forall n : nat, {P n> + {" P n}) -> 

{n : nat I ~ P n} + {(forall n : nat, P n)> 

To see why this implies all 77q sentences are decidable, consider an arbitrary TTg 
sentence If <^ is 77q, then it is decidable by the basic properties of TTg sentences. 
Otherwise, if ip is of the form Vn : N.'(/'(n) where i/'(n) is decidable by our inductive 
hypothesis. The above lemma allows use to conclude that is decidable from the fact 
that i/'(n) is decidable. 



3 The construction of the isomorphism 

In this section we briefly present the algebraic hierarchy present in CoRN (it is described 
in detail in and 0). We show that the Coq reals fulfill the requirements of a 
constructive real number structure, and hence they are isomorphic to any other real 
number structure. 



3.1 Building a constructive reals structure based on Coq reals 

The collection of properties making up a real number structure in CoRN is broken 
down to form a hierarchy of different structures. The first level, CSetoid, defines the 
properties for equivalence and apartness. The next level is CSemigroup which defines 
some properties for addition. More structures are defined on top of each other all 
the way up to the COrderedField structure — a constructive ordered field does not 
require trichotomy. Finally, the CReals structure is defined on top of the COrderedField 
structure. The full list of structures is given below. 
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CSetoid 

CSemiGroup 

CMonoid 

CGroup 

CAbGroup 



constructive setoid 



semi group 

monoid 

group 

Abelian group 

ring 

field 

ordered field 

real number structure 



CRing 
CField 



COrdField 
CReals 



To prove that classical reals form a constructive real number structure, we cre- 
ated instances of all these structures for the classical real numbers (called RSetoid, 
RSemigroup, etc.). For example, RSetoid is the constructive setoid based on Coq real 
numbers. The carrier is R and Leibniz equality and its negation are used as the equal- 
ity and apartness relations. The proofs of the setoid properties of these relations are 
simple. 

The basic arithmetic operations from Coq real numbers shown to satisfy all the 
properties required up to COrdField. The proofs of these properties follow straight- 
forwardly from similar properties provided by Coq's standard library. For details, we 
refer the reader to CoRN source files [2]. We present just the final step, the creation of 
the CReals structure based on the ordered field. 

Two additional operations are required to form a constructive real numbers struc- 
ture from a constructive ordered field: the limit operation and a function that realizes 
the Archimedian property. The limit operation is the only step where the facts about 
Coq reals cannot naively be used to instantiate the required properties. This is because 
the convergence property of limits for the Coq reals only establishes that there exists 
a point where the sequence gets close to the limit using the Prop based quantifier, 
whereas CReals requires such a point to exist using the Set based quantifier. One can- 
not directly convert a Prop based existential into a Set based one, because information 
is not allowed to flow from the Prop universe to the Set universe. 

The exact Coq goal asks us to show that if for any e there is an index in a sequence 
A'^ such that all further elements in the sequence are closer to the limit value than e. 
The related property from the Coq library is shown as hypothesis u. 

e : R 

eO : < e 

u : forall eps : R, eps > -> exists N : nat , 
forall n : nat, 

(n >= N)y,nat -> Rf unctions .R_dist (s n) x < eps 



{N : nat I forall m : nat, 

(N <= m)"/.nat -> AbsSmall e (s m[-]x)} 

To prove this goal, we first use the constructive_indef inite_description_nat 
lemma to reduce the Set based existential to a Prop based one. Applying this lemma 
to our goal from before reduces the problem to the following goal. 

e : R 

eO : < e 

u : forall eps : R, eps > -> exists N : nat, 
forall n : nat, 



(1/1) 



7 



(n >= N)y.nat -> Rf unctions .R_dist (s n) x < eps 

(2/2) 

exists N : nat, forall m : nat , 

(N <= m)y.nat -> AbsSmall e (s m[-]x)} 

This now follows easily from the hypothesis. However, we are also required to prove 
the decidability of the predicate: 

(1/2) 

{(forall m : nat, (xO <= m)y,nat -> AbsSmall e (s m[-]x))} + 
{" (forall m : nat, (xO <= m)y,nat -> AbsSmall e (s m[-]x))} 

This goal appears hopeless at first because we are required to prove the decidability 
of a III sentence. However, we can use the f orall_dec lemma from the previous section 
to prove the decidability of this sentence. This complete the proof that the classical 
real numbers form a constructive real number structure. 

3.2 The isomorphism 

Niqui shows in Section 1.4 of his PhD thesis |11) that all constructive reals structures are 
isomorphic, the proof is present in CoRN as iso_CReals. The constructed isomorphism 
defines two maps that are inverses of each other and proves that the isomorphism 
preserves the constants and 1, arithmetic operations and limits. More details can be 
found in |llj . 

In order to use the isomorphism in an effective way, we need to show that the 
definitions of basic constants and the operations are preserved. Since the reals of the 
standard library of Coq are written as R and CoRN reals as IR, we called the two 
functions of the isomorphism RasIR and IRasR. From Niqui's construction, one obtains 
the basic properties of this isomorphism: 

— Preserves equality and inequalities: 

Lemma R_eq_as_IR : forall x y, (RasIR x [=] RasIR y -> x = y) . 

Lemma IR_eq_as_R : forall x y, (x = y -> RasIR x [=] RasIR y) . 

Lemma R_ap_as_IR : forall x y, (RasIR x [#] RasIR y -> x <> y) . 

Lemma IR_ap_as_R : forall x y, (x <> y -> RasIR x [#] RasIR y) . 

Lemma R_lt_as_IR : forall x y, (RasIR x [<] RasIR y -> x < y) . 

— Preserves constants: 0, 1 and basic arithmetic operations: +, — , *: 
Lemma R_Zero_as_IR : (RasIR RO [=] Zero) . 

Lemma R_plus_as_IR : forall x y, (RasIR (x+y) [=] RasIR x [+] RasIR y) . 

An important difference between the definition of real numbers in the Coq standard 
library and in CoRN is the way partiality is handled. Partial functions are defined as 
total function for the Coq reals, but their properties require proofs that the function 
parameters are in the appropriate domain. For example, division is defined as a total 
operation on real numbers; however, all the axioms that specify properties of division 
have assumptions that the reciprocal is not zero. This means that the term ^ is some 
real number, but it is not possible to prove which one it is. 
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In CoRN, partial functions require an additional argument, the domain condition. 
Division is a three argument operation; the third argument is a proof that the divisor 
is apart from zero. Other partial functions, such as the logarithm, are defined in a 
similar way. We prove that this isomorphism preserves these partial functions. These 
lemmas require a proof that the arguments are in the proper domain to be passed to 
the domain conditions of the CoRN functions. 

— Preserves the reciprocal and division for any proof: 

Lemma R_div_as_IR : forall x y (Hy : Dom (f_rcpcl' IR) (RasIR y)), 
(RasIR (x/y) [=] (RasIR x [/] RasIR y [//] Hy)). 

Niqui's theorem proves the basic arithmetic operations and limits are preserved by 
the isomorphism. However, the real number structure does not specify any transcen- 
dental functions. Therefore it is necessarily to manually prove that these functions are 
preserved by the isomorphism. This may be easy if the Coq and CoRN definitions are 
similar, but they may be difficult if the two systems choose different definitions for the 
same function. 

— Preserves infinite sums: 

The proof that the values of the sums are the same requires again uses the de- 
cidability of IIq sentences and constructive-indef inite_<iescriptiorL_rLat. The 
term prf is the proof that the series converges. 

Lemma R_inf sum_as_IR : forall (y: R) a, 
Rfimctions . inf init_sum a y -> forall prf, 
RasIR y [=] series_siim (fun i : nat => RasIR (a i) ) prf . 

— Preserves transcendental functions: exp, sin, cos, tan. In 

Lemma R_exp_as_IR : forall x, RasIR (exp x) [=] Exp (RasIR x) . 
Lemma R_sin_as_IR : forall x, RasIR (sin x) [=] Sin (RasIR x) . 
Lemma R_cos_as_IR : forall x, RasIR (cos x) [=] Cos (RasIR x) . 
Lemma R_tan_as_IR : forall x dom, RasIR (tan x) [=] Tan (RasIR x) dom. 
Lemma R_ln_as_IR : forall x dom, RasIR (In x) [=] Log (RasIR x) dom. 

We finally prove that the isomorphism preserves the constant n. This was more 
difficult because the tt in Coq is defined as the infinite sum 

°° (—1)* 

7rCog=de/^^^^, (3) 
i=0 

while in CoRN tt is defined as the limit of the sequence 

i = / ° if n = 

P^n def + cos{pin-i) Otherwise 

■^CoRN =def lim pin- (5) 
n— >oo 

Both libraries contain proofs that the sine of tt is equal to zero, and additionally 

that it is the smallest positive number with this property. Using these properties it is 
possible to show that indeed the two definitions describe the same number: 

Lemma R_pi_as_IR : RasIR (PI) [=] Pi. 
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4 Computation with classical reals 

4.1 Solving ground inequalities 

O'Connor's work on fast real numbers in CoRN includes a semi-decision procedure (a 
decision procedure that may not terminate) for solving strict inequalities on construc- 
tive real numbers. With the isomorphism it is possible to use it to solve some goals for 
classical reals. 

Consider the example of proving exp{Tr) — tt < 20 for the classical real numbers: 

(1/1) 

exp PI - PI < 20 

Our tactic first converts the Coq inequality to a CoRN inequality by using the 
fact that the isomorphism preserves inequalities. Then it recursively applies the facts 
about the isomorphism to convert the Coq terms on both sides of the inequality and 
their corresponding CoRN terms. This is done with using a rewrite database and the 
autorowrite mechanism for setoids. The advantage of using a rewrite database is that it 
can be easily extended with new facts about new functions being preserved under the 
isomorphism. The disadvantage of this method is that the setoid rewrite mechanism is 
fairly slow in Coq 8.1. 

(1/1) 

Exp Pi [-] Pi [<] (One [+] One) [*] 

( (One [+] One) [*] (One [+] (One [+] One) [*] (One [+] One) ) ) 

(Recall that, in Coq, the real number 20 is simply notation for (1 + 1) * ((1 + 1) * (1 + 

(1 + 1)* (1 + 1))).) 

Once the expression is converted to a CoRN expression, CoRN's semi-decision 
procedure can be applied (which itself uses another rewrite database to change the 
representation again) . This semi-decision procedure may not terminate. If the two sides 
of the inequality are different, it will approximate the real numbers accurately enough 
to either prove the required inequality (or fail if the inequality the other direction 
holds). If the two sides are equal, then the search for a sufficient approximation will 
never terminate. 

The decision procedure for CoRN takes an argument which is used for the starting 
precision of the approximation. Setting it to an appropriate value can make search 
faster, if the difference between the sides is known a priori. Our decision procedure 
also takes this an argument and passes it on to the CoRN tactic. 

We have shown the intermediate step above for illustration purposes only. The 
actual tactic proves the theorem in one step: 

Example xkcd217 : (exp PI - PI < 20) . 

R_solve_ineq (l#l)'/,Qpos. 

Qed. 

Automatic rewriting is not enough to convert partial functions like division and 
logarithm. The additional parameters needed in CoRN are the domain conditions. The 
tactic itself could be called recursively to generate the assumptions. Unfortunately Coq 
8.1 cannot automatically rewrite inside dependent products, making the recursive tactic 
more difficult to create. We understand that Coq 8.2's new setoid rewriting system will 
allow rewriting in dependent products, and we expect this to greatly simply the creation 
of a recursive tactic. 
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4.2 Using facts about Coq reals in CoRN 

The standard library of Coq contains more properties of real numbers than CoRN. 
It also contains more tactics, like f ourier for solving linear constraints. By using the 
isomorphism the other way, it is possible to apply these tactics while working with 
CoRN. Using the isomorphism this way is controversial because using the classical 
reals means that the axioms of classical logic are assumed. 

We will show how a goal that would normally be proved by the fourier tactic 
in Coq reals can be done in CoRN. We will show it on a very simple goal, but the 
procedure is similar: 

x<y^x<y + l. (6) 

The goal written formally in Coq is: 

Goal forall x y:IR, (x [<] y) -> (x [<=] y [+] One). 

After introducing the assumptions we can apply the isomorphism to the inequalities 
both in the assumptions and in the goal: 

intros x y H; rapply IR_le_as_R_back. 
assert (HH := R_lt_as_IR_back H) . 

Since the isomorphism preserves all the functions in the goal and assumptions, we 
can apply the facts to change the terms to terms operating on the isomorphism of the 
variables, and then the fourier tactic is applicable: 

replace RHS with (IRasR y + IRasR One) by symmetry; rapply IR_plus_as_R. 
replace (IRasR One) with 1. 2: symmetry; apply IR_One_as_R. 
fourier . 
qed. 

A similar transformation can be performed to use other facts and tactics from the 
Coq library. 

5 Related Work 

Melquiond has created a Coq tactic that can solve some linear inequalities over real 
number expressions using interval arithmetic and bisection [9]. This tactic is currently 
limited to expressions from arithmetic operations and square root, but could support 
transcendental functions via polynomial approximations. It also has the advantage that 
it can solve some problems that involve constrained variables. 

Many other proof assistants include facts about transcendental functions that could 
be used for approximating expressions that involve them. However there are few mech- 
anisms for approximating real numbers automatically since to compute effectively this 
has to be done either by constructing the real numbers with approximation in mind, or 
by using special features of the proof assistant. The latter approach is used effectively 
for example in HOL Light, due to a close interplay between syntax and semantics. 

The real numbers in HOL Light are constructed [6], but the approximation mech- 
anism does not depend on this. Instead the calc_real tactics use the fact that terms 
are transparent and destruct a term or goal to look inside it. This allows creating a 
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tactic that approximates a given real expression, by approximating subexpressions and 
is used to create the REALCALC_REL_CDNV tactic that proves inequalities on ground real 
numbers. 

Obua developed a computing library for Isabelle [10]. In his PhD |12) he shows 
examples of computing bounds on real number expressions using computation rather 
than deduction. 

Lester implemented approximations of real number expressions in PVS ,7.. Results 
of real number functions are proved to have fast converging Cauchy sequences when 
their parameters have fast converging Cauchy sequences. Cauchy sequences for many 
real number functions are effective and can be evaluated inside PVS. 



6 Conclusion 

We have formalized a proof that the axioms of Coq's classical real numbers imply 
the decidability of TTq statements. We used this fact to prove that these classical real 
numbers form a constructive real number structure. Then we used the fact the all 
real number structures are isomorphic to use tactics designed for one domain to solve 
problems in the other domain. In particular, we showed how to automatically prove a 
class of strict inequalities on real number expressions. 

The lemmas showing the decidability of 77q statements have been added to the 
standard library and will be made available in the 8.2 release of Coq. The isomorphism 
and the tactics used to prove inequalities over the Coq reals have been added to the 
CoRN library. They will be available with the next release of CoRN, which will appear 
at the same time Coq 8.2 is released. 



6.1 Future Work 

We wish to extend our tactics to solve inequalities over terms that involve partial func- 
tions. This should be easier to do in Coq 8.2. Currently the translation of expressions 
from one domain to another is quite slow. We would like to investigate ways that this 
could be made faster. We would also like to automate the translation from CoRN 
expressions to Coq expressions so that CoRN can have its own f ourier tactic. 
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